Suspicious NTDS.DIT Exfiltration Activity

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•25

Detects suspicious process patterns indicative of NTDS.DIT exfiltration attempts. This includes the use of specific tools like NTDSDumpEx, PowerShell scripts (e.g., NTDSgrab.ps1), and command-line utilities (ntdsutil.exe, copy command) to access or copy the ntds.dit file. The rule also looks for these activities originating from suspicious image folders like Apache, Tomcat, AppData, Temp, Public, or PerfLogs.